Product Privacy Statement (GDPR / KVKK)

1. Who we are

This Product Privacy Statement explains how Breath Studios processes personal data when you use the Custala platform. It complements our Privacy Policy and Data Processing Agreement (DPA).

Operator: Breath Studios · Product: Custala · Website: https://breathstudios.net/ · Contact: info@breathstudios.net.

2. Our role under data protection law

When you use Custala: your organisation is usually the Data Controller — they determine why and how your data is used; Breath Studios acts as the Data Processor — we process personal data on behalf of your organisation, under their instructions.

Our customers enter into a Data Processing Agreement (DPA) with us, which governs how we process personal data on their behalf, including security, confidentiality, and data-subject rights.

Questions about how your organisation uses your data should go to them first. Questions about how Breath Studios processes data as a Processor: info@breathstudios.net.

3. What data we process

Depending on how the Service is configured by your organisation, we may process: manager / admin identifiers (name, email, role); usage and activity data (logins, interactions); team, segment and access-scope configuration; technical logs as needed for security and operations.

4. How we use data

We process personal data to provide and operate Custala; generate insights and recommendations for managers (including Ala AI coaching on anonymised context); improve product functionality and user experience; and maintain security and platform performance.

We do not sell personal data to third parties.

5. Legal basis for processing

We process personal data on lawful bases under applicable law (including, where relevant, GDPR and Türkiye’s KVKK), typically: contractual necessity — processing required to deliver the Service under our agreement with your organisation; and legitimate interests — improving the product, ensuring security, and analysing aggregated usage trends, where these interests are not overridden by your rights and freedoms.

Where we rely on legitimate interests, we balance our interests against the rights of data subjects. A summary of that assessment is available on request at info@breathstudios.net.

6. Anonymity and feedback

Custala is designed to support anonymous feedback, helping teams share honest input while protecting individual privacy.

To support this: feedback is aggregated before being presented to managers; reports are only generated once a minimum response threshold is met; individual responses are not intended to be visible to managers. Survey links do not require employees to create accounts. Segment tags (facility, shift, department) support fair grouping and access control — not naming individuals. Managers with restricted scopes only see data within their assigned segments.

Absolute anonymity cannot be guaranteed in every situation. In smaller teams or where response patterns are highly identifiable, individuals could be inferred indirectly. Organisations are responsible for using the platform appropriately, including ensuring sufficient group sizes where anonymity is expected, and not attempting to identify individuals.

Custala is designed to provide meaningful team-level insight, not to monitor or evaluate named individuals.

7. Automated processing and AI insights

Custala uses automated processing and AI-powered features (Ala, powered by Google Gemini) to generate insights and recommendations based on feedback and platform data. These insights are intended to support — not replace — human decision-making by managers.

We do not make solely automated decisions that produce legal or similarly significant effects on individuals. All recommendations require human review and judgement before action is taken.

Ala receives anonymised aggregate context and scrubbed notes and must not invent employee identities. If your organisation uses Custala in a way that may involve automated decision-making with significant effects, contact us to discuss your obligations.

8. Data retention

We retain personal data only for as long as necessary to provide the Service and meet our legal obligations.

Upon termination of the Service: Breath Studios will, at the Controller’s choice, delete or return Personal Data within 90 days of the termination date; provide written confirmation of deletion upon request; and may retain Personal Data beyond this period only where required by applicable law, informing the Controller of any such retention.

Customers may request deletion by contacting info@breathstudios.net.

9. Security

We implement appropriate technical and organisational measures to protect personal data, including role-based access controls; encryption of data in transit and at rest where appropriate; secure hosting via Hostinger; and regular monitoring and security assessments.

10. Sub-processors

We use trusted providers to deliver the Service, including: Hostinger for cloud hosting and infrastructure; Lemon Squeezy for payment processing; Resend for transactional email delivery; and Google Gemini for Ala AI coaching.

Sub-processors are required to process data in accordance with applicable data protection law and are bound by appropriate data protection agreements where required.

11. Your rights

Under applicable data protection law you may have the right to: access your personal data; correct inaccurate or incomplete data; request deletion; restrict or object to processing in certain circumstances; data portability; and object to automated processing where it produces significant effects.

To exercise your rights, contact your organisation first (as Data Controller). You may also contact us at info@breathstudios.net and we will assist where we are able.

If you have concerns about how your data is handled, you may lodge a complaint with your local data protection authority (in Türkiye, where applicable, the Personal Data Protection Authority — KVKK). We encourage you to contact us first so we can try to resolve your concerns.

12. International transfers

Where personal data is transferred outside Türkiye or the EEA, we take steps to ensure appropriate safeguards required by applicable law are in place.

13. Additional rights by region

Depending on where you are based, you may have additional privacy rights under local laws. Below is a summary. In all cases your organisation (as Data Controller) is usually your first point of contact; we support them as Processor.

United States — If you are a resident of certain US states (including California), you may have rights to request access, deletion, or correction of personal data, and to opt out of the “sale” or “sharing” of personal data as those terms are defined under applicable US privacy laws. Where permitted, you may designate an authorised agent to make requests on your behalf (we may require verification). For US state privacy laws, Breath Studios acts as a “service provider” to its customers: we process personal data only on behalf of customers and in accordance with their instructions, and do not retain, use, or disclose it for purposes other than providing the Service. We do not sell or share personal data as those terms are defined under applicable US privacy laws. Contact your organisation or info@breathstudios.net.

Canada — We process personal data with your organisation’s authority for the purposes in this statement. Your organisation is responsible for obtaining consent to use the platform and informing you how data is used. Where required, you may withdraw consent subject to legal or contractual restrictions, usually by contacting your organisation. You may also request access or correction.

Australia — You may have rights to access personal data held about you, request correction of inaccurate data, and raise a complaint. Contact your organisation first, or info@breathstudios.net. If unsatisfied, you may contact the Office of the Australian Information Commissioner (OAIC).

European Union, United Kingdom and Türkiye — You may have rights including access, correction, deletion, restriction or objection to processing, and data portability. As Breath Studios acts as a Data Processor for organisation customers, your organisation is responsible for responding to these requests; we support them. You may also lodge a complaint with your local data protection authority.

We are committed to handling personal data responsibly no matter where you are based. Questions: info@breathstudios.net.

14. Changes to this statement

We may update this Product Privacy Statement from time to time. We will notify users of material changes where reasonably practicable. The latest version will always be available on the Custala website.

15. Contact

For data protection queries: info@breathstudios.net · https://breathstudios.net/